ITAG Lunchtime Seminar Filemaker Best Practices and Service Offerings Scott Thorne, IS&T ISDA “Sensitive Data and Local Databases” MacKenzie Smith, Libraries “MIT Libraries Policy on the Use of Filemaker for Applications” Jeff Reed, Cecilia Marra, IS&T DCAD “Filemaker Service Offerings” ITAG Lunchtime Seminar Series February 7, 2007http://web.mit.edu/itag

Sensitive Data and Local Databases Feb 7th 2007 Scott Thorne

Background There is growing need to build small systems to meet departmental business needs There is growing need to build small systems to meet departmental business needs There is a growing problem of data spills There is a growing problem of data spills TJX etc TJX etc Creates potential risk for the Institute Creates potential risk for the Institute

Response Promote Awareness Promote Awareness Provide Recommendations Provide Recommendations Technical Technical Business Business Provide Resources Provide Resources

Use local database technology such as Filemaker for -- Local Applications only Local Applications only That meet the following criteria: That meet the following criteria: Relatively small & simple Relatively small & simple 50 users 50 users 20 tables or files 20 tables or files 100 fields 100 fields No Sensitive Data No Sensitive Data Use the recommended version and configuration Use the recommended version and configuration Manage data not needed by other systems Manage data not needed by other systems Warehouse Warehouse

Sensitive Data More work required to classify data and gain consensus on procedures More work required to classify data and gain consensus on procedures Extremely Sensitive Extremely Sensitive Disclosure causes harm Disclosure causes harm Financial or otherwise Financial or otherwise Organizations or Individuals Organizations or Individuals Example: SSN Example: SSN Collected with the promise of confidential treatment Collected with the promise of confidential treatment Example: Faculty Survey Information Example: Faculty Survey Information Sensitive Sensitive Choose to keep confidential, but does not cause harm Choose to keep confidential, but does not cause harm Example: Salaries Example: Salaries or more recently or more recently

Implementation Use FileMaker Server instead of peer-to-peer Use FileMaker Server instead of peer-to-peer Use Strong Passwords Use Strong Passwords Require a password for FileMaker Server Require a password for FileMaker Server Turn on SSL Turn on SSL Hide Files from network scanning (port 5003) Hide Files from network scanning (port 5003) Implement a backup and recovery procedure Implement a backup and recovery procedure Physically secure the server and backup media Physically secure the server and backup media

Data Common Sense Don't store data unless you know why Don't store data unless you know why Don't collect data that is already collected at MIT Don't collect data that is already collected at MIT Don't collect data until it's needed Don't collect data until it's needed Don't store data unless there is a plan to maintain it Don't store data unless there is a plan to maintain it Decide data retention policies before collecting data Decide data retention policies before collecting data Review data models before building a system Review data models before building a system Document the data definition and sensitivity before collection Document the data definition and sensitivity before collection Only update data in its System of Record Only update data in its System of Record

More Resources